CVE-2021-25292

Опубликовано: 19 мар. 2021

Источник: nvd

CVSS3: 6.5

CVSS2: 4.3

EPSS Низкий

Описание

An issue was discovered in Pillow before 8.1.1. The PDF parser allows a regular expression DoS (ReDoS) attack via a crafted PDF file because of a catastrophic backtracking regex.

Ссылки

https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html
Release Notes
Vendor Advisory
https://security.gentoo.org/glsa/202107-33
Third Party Advisory
https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html
Release Notes
Vendor Advisory
https://security.gentoo.org/glsa/202107-33
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:*

Версия до 8.1.1 (исключая)

EPSS

Процентиль: 77%

0.01727

Низкий

6.5 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-1333

Связанные уязвимости

CVE-2021-25292

CVSS3: 6.5

ubuntu

больше 5 лет назад

An issue was discovered in Pillow before 8.1.1. The PDF parser allows a regular expression DoS (ReDoS) attack via a crafted PDF file because of a catastrophic backtracking regex.

CVE-2021-25292

CVSS3: 7.5

redhat

больше 5 лет назад

An issue was discovered in Pillow before 8.1.1. The PDF parser allows a regular expression DoS (ReDoS) attack via a crafted PDF file because of a catastrophic backtracking regex.

CVE-2021-25292

CVSS3: 6.5

debian

больше 5 лет назад

An issue was discovered in Pillow before 8.1.1. The PDF parser allows ...

GHSA-9hx2-hgq2-2g4f

CVSS3: 6.5

github

больше 5 лет назад

Regular Expression Denial of Service (ReDoS) in Pillow

ALT-PU-2021-1491

CVSS3: 9.8

altlinux

больше 5 лет назад

ALT-PU-2021-1491: package `python3-module-Pillow` update to version 8.1.1-alt1

EPSS

Процентиль: 77%

0.01727

Низкий

6.5 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-1333